search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.39k stars 902 forks source link

Failed to deploy falco on GKE #920

Closed Kaizhe closed 4 years ago

Kaizhe commented 5 years ago

What happened: Failed to deploy falco on GKE

What you expected to happen: Falco run successfully on GKE

How to reproduce it (as minimally and precisely as possible): Bring up a GKE cluster (default one), deploy falco from market place

Anything else we need to know?:

Kaizhes-MacBook-Pro:rules kaizhehuang$ kubectl logs -f falco-security-1-fkc8b 
* Setting up /usr/src links from host
* Mounting debugfs
Found kernel config at /proc/config.gz
* COS detected (build 11647.329.0), downloading and setting up kernel headers
* Downloading https://storage.googleapis.com/cos-tools/11647.329.0/kernel-src.tar.gz
* Extracting kernel sources
* Configuring kernel
scripts/sign-file.c:25:30: fatal error: openssl/opensslv.h: No such file or directory
compilation terminated.
make[1]: *** [scripts/Makefile.host:102: scripts/sign-file] Error 1
make: *** [Makefile:574: scripts] Error 2
* Trying to compile BPF probe falco-probe-bpf (falco-probe-bpf-0.14.0-x86_64-4.14.145+-e2bdf498e5c7b4a4b60c9d2f4c53f14d.o)
In file included from /usr/src/falco-0.14.0/bpf/probe.c:23:
/usr/src/falco-0.14.0/bpf/fillers.h:2006:26: error: no member named 'loginuid' in 'struct task_struct'
                loginuid = _READ(task->loginuid);
                                 ~~~~  ^
/usr/src/falco-0.14.0/bpf/plumbing_helpers.h:18:28: note: expanded from macro '_READ'
#define _READ(P) ({ typeof(P) _val;                             \
                           ^
In file included from /usr/src/falco-0.14.0/bpf/probe.c:23:
/usr/src/falco-0.14.0/bpf/fillers.h:2006:26: error: no member named 'loginuid' in 'struct task_struct'
                loginuid = _READ(task->loginuid);
                                 ~~~~  ^
/usr/src/falco-0.14.0/bpf/plumbing_helpers.h:20:44: note: expanded from macro '_READ'
                    bpf_probe_read(&_val, sizeof(_val), &P);    \
                                                         ^
In file included from /usr/src/falco-0.14.0/bpf/probe.c:23:
/usr/src/falco-0.14.0/bpf/fillers.h:2006:12: error: assigning to 'kuid_t' from incompatible type 'void'
                loginuid = _READ(task->loginuid);
                         ^ ~~~~~~~~~~~~~~~~~~~~~
3 errors generated.
make[2]: *** [/usr/src/falco-0.14.0/bpf/Makefile:33: /usr/src/falco-0.14.0/bpf/probe.o] Error 1
make[1]: *** [Makefile:1543: _module_/usr/src/falco-0.14.0/bpf] Error 2
make: *** [Makefile:18: all] Error 2
mv: cannot stat '/usr/src/falco-0.14.0/bpf/probe.o': No such file or directory
* Trying to download precompiled BPF probe from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-bpf-0.14.0-x86_64-4.14.145%2B-e2bdf498e5c7b4a4b60c9d2f4c53f14d.o
curl: (22) The requested URL returned error: 404 Not Found
* Failure to find a BPF probe
Wed Nov  6 22:13:23 2019: Falco initialized with configuration file /etc/falco/falco.yaml
Wed Nov  6 22:13:23 2019: Loading rules from file /etc/falco/falco_rules.yaml:
Wed Nov  6 22:13:25 2019: Loading rules from file /etc/falco/falco_rules.local.yaml:
Wed Nov  6 22:13:25 2019: Unable to load the driver. Exiting.
Wed Nov  6 22:13:25 2019: Runtime error: can't open BPF probe '/root/.sysdig/falco-probe-bpf.o': No such file or directory. Exiting.

Environment:

chattarajoy commented 4 years ago

facing the same issue. Can someone look into this?

Kaizhe commented 4 years ago

cc @mstemm , might be related to the kernel module ?

stale[bot] commented 4 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

kbojjireddy commented 4 years ago

I'm facing the same issue

chattarajoy commented 4 years ago

I changed the instance types to ubuntu based instead of containerd ones and it worked

fntlnz commented 4 years ago

It should work now with COS, if anyone else is wondering.

tdickman commented 4 years ago

@fntlnz I'm still running into this with COS.